Slashdot Mirror
The Story Behind a Windows Security Patch Recall
bheer writes "Raymond Chen's blog has always been popular with Win32 developers and those interested in the odd bits of history that contribute to Windows' quirks. In a recent post, he talks about how an error he committed led to the recall of a Windows security patch."
The DLL that hosted the shell extension created a worker thread, so it did an extra LoadLibrary on itself so that it wouldn't get unloaded when COM freed it as part of CoUninitialize tear-down. ... and then waiting for the worker thread to respond with a "Okay, I'm all done" event." I usually am a brute and kill -9 things that won't listen. Lesson of the day? When in doubt kill -9 it all.
Infiltrated dot Net
I didn't realize microsoft developers were real people and might have real feelings. Maybe we should cut them some slack.
Why are the trolls out in force here? Oh, Microsoft... Nevermind...
Raymond Chen would be iFired, or at least told to iRTFM.
Seriously, it's good to get a glimpse of the interactions in the dev side of MS. It's astonishing that MS even allows this to happen at all. The March 07 Wired had a feature on Channel 9 that humanized the MS organization quite a bit, IMO. It's not just about chair-throwing, marketing hyperbole, and world domination after all... oh wait.
Science never settles, never rests.
This is fascinating. The system for exiting a process is so complicated that a lot of implementations fail. In fact, it's so complicated that even Microsoft can't get it right. Sounds like an unbounded loop to me.
Okay, he made an error. Why the HELL wasn't it caught in QA? Microsoft wants us to believe that the reason that we have to wait for patches is that they are getting some kind of exhaustive QA. This patch and executable were specifically created to avoid problems with invalid shell extensions. Don't you think that given that fact the thing to do would be to test it with some invalid shell extensions?
This is the reason that Windows admins have to be so much more paranoid about patches than the rest of us. A Windows patch is highly likely to be a big pile of crap that causes your system to not work properly. I think we can all remember certain service packs that broke various versions of Windows NT pretty much completely...
If you can't have confidence that security patches will fix more than they break, how can you have sufficient confidence to even install that vendor's products, let alone count on them for mission-critical applications?
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
I think the lesson here is not that this guy should have been more careful about programming, it's that no amount of careful programming can overcome a stupid design. It's stupid that there are magical filenames in the form of UUIDs that cause Explorer to load and run arbitrary DLLs. You can't get around this stupidity with some kind of speculative watchdog thread that works with what sound to me like some seriously questionable heuristics.
They should have simply got rid of the magic naming system in favor of something explicit, such as a Shell Extension Interface that a shell extension must fully implement.
The people at Norman Virus Control development will enjoy reading this... when they are not still at work or vast asleep.
Next time make sure to do that in a urinal. That's always funny.
This illustrates the kind of employee I like to have. One who can talk about his mistakes the same way he talks about anything else work-related.
Some years ago I myself made a rather expensive mistake which involved the design of an aircraft structure. The fellow I was working for at the time had one of those razor-blade intellects and I got called into his office for a chat. When he asked me what happened I had two choices, weasel or turkey. In engineering it's always possible to talk the complicated talk and hope to obfusticate your way out of a situation, but fortunately I said "I make a mistake." And you know what? That was exactly the answer he was looking for.
You see, the most important thing is not to be perfect, it's to be honest. That's what a boss, of which I am one now, wants.
If you have a boss that doesn't want that, better watch out for yourself.
Equine Mammals Are Considerably Smaller
On the day after Patch Tuesday, January 2006, I got a somewhat frantic call from a client. She's a lawyer, had a filing deadline, but could not save a document in MS Word. That's not all that this patch broke: you couldn't open My Computer or My Documents on the desktop (though you could navigate to them by typing the path in the Start -> Run box), and IE wouldn't let you type just "www.[website].com" in IE's address bar. You had to prepend the "http://".
.exe and .dll files that are named just like Windows system files. Keeps my foot bullet-free.
.exX.
I verified that "Save" and "Save As..." were not working in Word. Word would just hang and only Task Mangler could shut it down. I carry the Sysinternals utilities on CD and USB key, so I rebooted and ran FILEMON, REGMON, and PROCEXP to see what was happening when I tried to save a doc in Word. Sure enough, Word would spawn verclsid.exe as a child process and then hang.
I googled "verclsid" and "Explorer", got nothing on the web and about a dozen Usenet posts from people having the same problem. I played a hunch and renamed verclsid.exe to verclsid.exX. I do that when I'm manually hunting malware that leaves
Problem solved. When the patch for the patch came out, a working verclsid.exe was dropped in %system% and I deleted the
Oh, and the buggy third party shell extension came with a very common HP DeskJet printer. As for Google, the next day I googled "verclsid": there were hundreds of web results and Usenet hits. The day after, tens of thousands. This one bit a lot of people in the ass.
k.
"In spite of everything, I still believe that people are really good at heart." - Anne Frank
Reminds me of a famous story about Jack Welch, former GE CEO. One of the company's division managers made a mistake costing the company $10 million in one quarter. When the quarterly reports came out, he got a call from headquarters telling him to be in Welch's office in NY the next morning. Welch grilled the man for some time, asking him what he was thinking and how he could possibly lose so much money. When it seemed Welch had finished, the manager said he understood that Welch had to fire him now. To which Welch replied, "Why would I fire you when I just invested $10 million in your education?"
"Shell Extension Interface that a shell extension must fully implement" - actually, shell extenstions must fully implement their shell extension interface. If you had RTFA (save the "you must be new here" jokes for later please) you would have known that that wasn't the problem.
Rather, they were trying to fix Explorer crashing on trying to see if an object implemented the interface, when this object was itself buggy enough to crash when you try to see if the interface is implemented by the object. Totally different issue.
This pretty much rendered Windows useless (explorer, file open / save dialogs and the IE7 addressbar were not working) if you had software installed for HP cameras, HP scanners, or any HP DeskJet printer that included a card reader.
h ell Extensions\Cached" /V "{A4DF5659-0801-4A60-9607-1C48695EFDA9} {000214E6-0000-0000-C000-000000000046} 0x401" /T REG_DWORD /F /D 1
Courtesy of JSI FAQ:
You experience one or more of the following strange behaviors:
- You are unable to open special folders, like My Documents or My Pictures.
- Some 3rd party applications hang when accessing My Documents.
- Office files won't open in Microsoft Office if they are stored in My Documents.
- Entering an address into Internet Explorer's address bar does nothing.
- The Send TO context menu has no effect.
- The plus (+) sign on a folder in Windows Explorer does nothing.
- Opening a file via an applications File / Open menu causes the application to hang.
This behavior is caused by a new VERCLSID.EXE binary, which validates shell extensions before Explorer.exe, the Windows Shell, can use them. VERCLSID.EXE is installed by the MS06-015 (908531) security update.
The following 3rd party applications cause VERCLSID.EXE to hang:
Hewlett-Packard's Share-to-Web Namespace Daemon ("%ProgramFiles%\hewlett-packard\hp share-to-web\Hpgs2wnd.exe), auto-started from the Registry Run key and the Startup menu, which ships with:
HP PhotoSmart software
Any HP DeskJet printer that includes a card reader
HP Scanners
Some HP CD-DVD RWs
HP Cameras
Sunbelt Kerio Personal Firewall which has a feature that prompts when Explorer launches VERCLSID.EXE, but you can configure it not to prompt.
To workaround this behavior, add the HP shell extension to the VERCLSID.EXE white list:
1. Open a CMD.EXE window.
2. Type the following command and press Enter:
REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\S
3. Shutdown and restart your computer.
NOTE: If you find other COM controls or shell extensions that cause this behavior, you can add them to the white list.
He'd have to get out of bed first.
And points out how their anti-competitive lockin approach has not only bitten them in the ass repeatedly, but only gotten worse as they incur additional scars on the scar tissue. The only reason they have to have their developers struggling to support third party apps is because they have never released proper APIs, and do not follow their own published interface methods when implementing features in Windows. With publicly available, stable APIs and consistent implementation the third party developers could deal with it themselves and everyone would benefit.
I recently helped someone install a home printer from HP, the SMALLEST "driver" installation option was 400 MEGABYTES, it defaulted to over 800 megs!
That's just insane.
Now multiply that by all the different revisions and patches of the HP drivers, and consider testing each Windows/Application patch against it (on every language, for every version).
You could deforest the planet with test pages before you hit every code path.
Speaking of Explorer Shell extensions, recent OS X converts may be curious about how Finder extensions work.
One might assume that the Finder extension framework is sprinkled with all sorts of Cocoa goodness, where objects are magically discovered, loaded, and consumed by Finder though some thoughtfully conceived Objective-C interfaces/protocols.
Nope. It's COM, complete with IUnknowns and HRESULTs, UUIDs and E_FAILs. (The headers are provided by Microsoft). Finder is, after all, just a plain old C++ application (as seen by its svelte memory footprint and quirky bugs/features), and therefore needs a COM-like framework for dynamically loading other C++ objects/extensions. So why not just use COM? This is known as the Core Foundation Plug-in Framework and is actually used in all sorts of places.
If you're curious, drill down into any package in ~/Library/Contextual Menu Items/, open Info.plist, and notice how the CFPluginFactories and CFPluginTypes start to look very similar to certain areas of the Windows Registry.
Well, *I* was surprised, anyway. Considering that both Objective-C and COM were conceived at roughly the same time (late 80s) to solve the roughly the same problem (Smalltalk dynamicism with C performance) I found it interesting that the two should end up meeting, on a Mac no less. I guess there's just no getting around that fact that there's still a lot of code out there that is written in, or needs to be written in static C/C++.
ENDUT! HOCH HECH!
I do not understand why this guy calls the addition they added a patch, seeing as it did not actually make a change in any existing code. Or might it be so that they made a copy of the explorer executable and patched it to become the verclsid executable ?Y B.jpg.
Well you got to hand it to the ms developers they surely know how to not fix the problem but rather work around the problem.
This brought back memories about an article that was on slashdot comparing the complexity of a mission critical file retrieval web server linux system call to a windows system call. Where the windows system call graphic looked like a child's first scratchings, no patterns to be recognized, and the Linux equivalence looked well like a Mondrian http://en.wikipedia.org/wiki/Image:Mondrian_CompR
Its only useful in a closed-source world where you cannot modify programs to suit the new API's.
It accumulates complexity over time.
The result is that even Microsoft can't get reasonably trivial things right.
Not to mention almost all Windows software code being highly complicated compared to equivalent code on other systems.
Its not magic, maybe, its a registry filename.
Microsoft, in its stupidity and/or attempt to complicate their system so that potential compatibility is more difficult, duplicated the functionality of the "file system" with the registry. That makes registry keys such as CLSID's filenames too. The grandparent was right in calling them magic file names.